[dependabot]

Removes basic-ftp. It's no longer used after updating ancestor dependency firebase-tools. These dependencies need to be updated together.

Removes basic-ftp

Updates firebase-tools from 15.18.0 to 15.36.0

Release notes

Sourced from firebase-tools's releases.

v15.36.0

• Fixed Hosting commands failing when unable to ensure the Firebase Hosting API is enabled, logging a warning instead. (#11335)
• Updated firebase init hosting and firebase init hosting:github to ensure the Firebase Hosting API is enabled during setup.
• Added an optional filterExpression parameter to the Crashlytics MCP list_events tool to filter by custom keys.
• Fixed Crashlytics filter validation rejecting web app version names without a build number.
• Improved Auth emulator startup time by compiling validation schemas lazily. (#11176)
• Updated the Firebase SQL Connect local toolkit to v3.4.26, which includes the following changes:
  • Internal improvements and bug fixes.
• Fixed the emulators startup message showing 127.0.0.1 for the Emulator UI and Hub when they listen on 0.0.0.0; it now also prints the address they listen on. (#6222)
• Fixed a race condition across a second boundary during accounts:signUp in the Auth emulator where validSince could exceed auth_time. (#11413)
• Added local machine config persistence to appcheck:debugtokens:create, --local support to appcheck:debugtokens:list, and appcheck:debugtokens:prune to clean up stale local debug tokens.
• Fixed database:import failing with an unhandled promise rejection when a batch write fails.
• Fixed emulator crashes when a Firestore rules reload or emulator HTTP handler throws.

v15.35.0

• Fixed high query latency on Linux in Data Connect PGlite emulator by enabling TCP_NODELAY on sockets. (#11402)
• Fixed the emulators startup message showing 127.0.0.1 for the Emulator UI and Hub when they listen on 0.0.0.0; it now also prints the address they listen on. (#6222)
• Fixed an issue on Windows where starting Java-based emulators (Firestore, Database, Pub/Sub, Storage) could open extra console windows or leave orphaned java.exe processes running after exit (#3871, #11261).
• Updated the Crashlytics MCP get_report tool to dynamically validate report names via listReports and support optional time granularity

v15.34.2

• Updated chokidar dependency to ^4.0.3 to remove vulnerable braces dependency (#11308).
• Fixed an issue where the Firebase MCP server referred to update_firebase_environment instead of firebase_update_environment.
• Updated the Firebase SQL Connect local toolkit to v3.4.25, which includes the following changes:
  • Internal improvements and bug fixes.
• Fixed CVE-2026-111181 by updating body-parser dependency.
• Fixed the Firestore emulator exiting when it could not watch the rules file for changes. It now logs a warning instead. (#4298)

v15.34.1

• Ensured the Firebase Hosting API is enabled before deploying and running other Hosting commands.
• Fixed an issue where empty inputs were accepted for Secret param values in Firebase Functions.
• Fixed an issue where the Firebase MCP server always suggested npx firebase-tools@latest even when the firebase CLI was installed.
• Fixed a Node.js url.parse() deprecation warning during firebase login.
• Updated the Firebase SQL Connect local toolkit to v3.4.24, which includes some internal bug fixes.
• Fixed 2nd Gen Auth Emulator CloudEvent payloads to conform to the Eventarc google.events.firebase.auth.v2.AuthEventData wire format (metadata.createTime, providerData[].uid, and removing tenantId from nested user data).

v15.34.0

• Fixed an issue where hosting:clone failed to locate source sites in other projects. (#11247)
• Updated Pub/Sub emulator to version 0.8.37.
• Fixed an issue where analytics timeouts could mask command errors or cause successful commands to exit with an error. (#6989)
• Fixed an issue where unhandled exceptions during Cloud Functions deployment could be silently ignored and exit with code 0 (#6989).
• Added crashlytics:heapdumps:{enable,disable,status} commands to manage Crashlytics Android heap dump collection. (#11225)
• Removed unused dependencies proxy-agent, universal-analytics, and @apphosting/common.
• Fixed an issue where throttled task queues stopped processing remaining tasks when a task exhausted its retries or timed out (#6989, #11040).
• Fixed a race condition in SourceTokenScraper that could cause concurrent function deployments to hang when refreshing an expired source token (#6989).
• Fixed an issue where a Function Kit and a functions codebase sharing the same source directory failed firebase.json validation. (#11253)
• Fixed an issue where Cloud Functions creation did not retry on HTTP 403 service account propagation errors. (#11251)
• Updated Auth deployment to use existing apps from any platform before creating a default web app. (#11250)
• No longer grant unecessary TRUNCATE privilege to writer roles in dataconnect:sql:migrate. (#11276)
• Updated the Firebase SQL Connect local toolkit to v3.4.23, which includes the following changes:

... (truncated)

Commits

• c2b1e50 15.36.0
• 38c0b5a Release v2.4.4 (#11483)
• 87c3636 fix(hosting): warn instead of failing when unable to ensure Hosting API is en...
• 32a593e [AI Improvement] [Task] Upgrade puppeteer devDependency from ^19 to ^25 for s...
• 5f0f21a fix(deps): upgrade vite to 8.3.1 and vite-plugin-singlefile to 2.3.3 (b/56766...
• c39fdda ci: avoid duplicate push + pull_request workflow runs on in-repo PRs (#11459)
• 3a25454 feat(crashlytics): add event filterExpression support and shared client helpe...
• 4a2fc3a feat(mcp): Adds crashlytics_setup tool (#11379)
• 210e7bc [AI Improvement] [Task] Fix no-misused-promises violations (Express 4 async h...
• 27b3daa fix(deps): upgrade nyc devDependency from ^15 to ^18 (b/567662388) (#11193)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.